Filtering approach for network system alarms

ABSTRACT

A method for creating an updateable report representing the alarm status of a network. Network alarms are categorized based on the source and type of alarm, the alarms are placed in a filtering system based on source and type, selected alarms are replaced with alarm representations, and a report is updated with alarm representations. The filtering system comprises non-temporal, temporal, and linkage-based filtering. Non-temporal filtering includes de-duplication, clear message mapping, and classification. Temporal filtering includes frequency-based and cycling-based filtering. Linkage-based filtering includes internal linkage-based and external linkage-based filtering. The network can comprise the interconnected networks of an enterprise or of a single domain of an enterprise. The domain can comprise a business domain or operating system domain. The network can comprise a group of client computers connected to a server computer. The report can be displayed on a computer screen or can be sent to another location for further processing.

CROSS-REFERENCE TO RELATED APPLICATIONS

Not applicable.

STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

Not applicable.

REFERENCE TO A MICROFICHE APPENDIX

Not applicable.

FIELD OF THE INVENTION

The present invention relates to the management of network alarms. Moreparticularly, embodiments of the present invention provide a method andapparatus for automatically filtering the alarms in a network.

BACKGROUND OF THE INVENTION

Telecommunications networks, computer networks, and other networkstypically include elements such as ATM switches, frame relay switches,voice switches, digital cross connect switches, multiplexers, routers,servers, and other equipment for processing and transmitting data.Network elements typically contain self-monitoring circuitry andsoftware that can detect internal and external conditions affecting theelements and activate messages that document these conditions. Many ofthese messages indicate potentially abnormal or erroneous conditionsfrom the local perspective of the reporting resource. Depending on thecontext, these messages might represent predictable noise requiring noaction or might indicate a major network failure requiring immediateattention. Any type of message that conveys evidence that an errorcondition might exist can be referred to as an alarm. Technicianstypically investigate a certain number of alarms to determine theircause and undertake corrective action. However, in large networks, thenumber of alarms can overwhelm the staff of technicians charged withoperating and maintaining the network. The wide variety of protocols,such as SNMP, CMW, CORBA, log files, Telnet/command line interfaces, andproprietary interfaces, used to deliver alarm information can increasethe difficulty of gathering and handling of alarm data. Since manuallyinvestigating large numbers of different types of alarms to distinguishsignificant alarms from insignificant alarms can be time-consuming,labor-intensive, expensive, and often impossible, technicians oftenattempt to focus their efforts on the most severe alarms, ignoring asignificant number of messages. This can leave many problems undetecteduntil specific complaints are received from impacted network users.

SUMMARY OF THE INVENTION

An embodiment of the invention is a method for creating an updateablereport representing the alarm status of a network. The method cancomprise categorizing all alarms generated in the network based on thesource and type of alarm, placing the alarms in at least one filteringsystem based on source and type, replacing selected alarms with alarmrepresentations, and updating a report with the alarm representations.The filtering system can include any or all of a group comprisingnon-temporal filtering, temporal filtering, and linkage-based filtering.Non-temporal filtering can include any or all of a group comprisingde-duplication, clear message mapping, and classification. Temporalfiltering can include any or all of a group comprising frequency-basedfiltering and cycling-based filtering. Linkage-based filtering caninclude any or all of a group comprising internal linkage-basedfiltering and external linkage-based filtering. The network can comprisethe interconnected networks of an enterprise or of a single domain of anenterprise. The domain can comprise a business domain of the enterpriseor an operating system domain of the enterprise. The network cancomprise a group of client computers connected to a server computer. Thereport can be displayed on a computer screen or can be sent to anotherlocation for further processing.

An alternative embodiment is a method for monitoring the alarm status ofa network that comprises capturing alarms generated by elements of thenetwork, applying at least one filter to the alarms which generatesalarm representations for selected alarms, displaying the generatedalarm representations and a selection of the alarms which have passedthrough the filters, monitoring the display, and taking action inresponse to the displayed alarm representations and alarms. Humanmonitors can generate alarm representations and can group selectedalarms subordinate to the alarm representations.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flowchart showing steps in an embodiment of the filteringapproach for network system alarms.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The filtering approach for network system alarms reduces the manualintervention needed to manage alarms. All network alarms are capturedand then categorized based on the source and the type of the alarm.Depending on their category, alarms are then sent through one or morefiltering systems that can reduce the number of alarms displayed byreplacing the underlying alarms coming from the network with alarmrepresentations. The reduction in the number of alarms may be referredto herein as removing alarms meeting certain criteria or selectingalarms meeting certain criteria. These terms are intended to beunderstood as effectively complementary, where selecting for certaincriteria is intended to have the same meaning as removing all alarmswhich do not meet those criteria. The filtering systems may be viewed ascomponents of a single overall filtering system or as a sequence ofseparate filtering systems working in concert or as a combination of thetwo. The use of the term system in this disclosure is not intended toprovide an indication of whether the coding is integrated, distributed,or modular. In a preferred embodiment, both alarms and alarmrepresentations are retained even when not selected for display or whenfiltered from display. For the purposes of this disclosure, an alarm isrecognized as a report from a network element. By comparison, an alarmrepresentation is a system report based on an alarm or a plurality ofalarms providing information to system technicians or operators eitherin addition to the simple alarm or in a more concise fashion than acollection of simple alarms. In this sense, an alarm representation maybe defined as a single alarm that acts as a surrogate for multipleunderlying alarms and as a newly generated alarm providing additionalinformation about underlying or companion alarms. The use of alarmrepresentations rather than the underlying alarms reduces the volume ofalarm-related information, thus reducing the effort required to processalarms. This reduction occurs by hiding the underlying alarms associatedwith an alarm representation from view, allowing a technician to seeonly a single message. In an embodiment of the invention, the underlyingalarms associated with an alarm representation can be examined byspecific request. In some embodiments, for the purposes of filtering,both alarms and alarm representations may be acted upon. Thus, an alarmrepresentation created by one filtering process may be, in turn, itselffiltered and/or replaced by another alarm representation.

The type of alarm representation depends on the type of filteringsystem. For example, some filtering systems may allow one alarm of aparticular type to pass through but mask out all other alarms of thesame type. Other filtering systems may generate a new alarm tosubstitute for multiple alarms of a particular type. The alarmrepresentations can be used to update a report that represents thestatus of the network. The report can take the form of a display thatappears on a computer screen, a message which is transmitted orotherwise made available for review, or a message that is transmittedelsewhere for automated processing. The report can be updated each timea new alarm representation is generated so that technicians can easilysee high-frequency alarms summarized into a single alarm representation.For the purposes of this disclosure, the use of a single alarm whilemasking duplicate alarms constitutes the use of a single alarmrepresentation. In one embodiment, the masked duplicate alarms remainaccessible as underlying information linked to the single alarmrepresentation.

In an embodiment of the invention, seven different types of filteringcan be used to process network alarms. Each type of filtering can beused independently or any combination of the seven types can be used.The first five of the filtering types may be generally categorized asnon-temporal and temporal filters, where non-temporal filters do notexpressly rely on a time component. Temporal filters, by comparison,consider time factors underlying events as a threshold to accomplish amore complex level of filtering.

In one type of non-temporal filtering, which can be referred to asde-duplication, repetitive alarms are eliminated. Many elementsretransmit previously sent alarms until the conditions that triggeredthe alarm are cleared. These additional alarms can become noise, maskingother problems. With de-duplication, a defined set of matching fields isgiven to each alarm type and these fields are embedded in the alarmmessages. These fields allow specific types of alarms to be easilyidentified so that multiple alarms of the same type can be replaced by asingle alarm representation. In an embodiment of the invention, acounter can be displayed to keep track of the number of similar alarmsthat have been masked.

One type of temporal filtering deals with the frequency of alarmarrival. Repeated alarms may arrive at different rates. Alarms of agiven type from a given source may be of no significance when the rateof arrival is infrequent, but may become critical when the arrivalfrequency rises sharply. Even informational alarms may becomesignificant if their rate of arrival peaks. In frequency-based alarmfiltering, policies on alarm frequency are created. A counting systemdetermines the number of alarms that occur in a period of time andcompares that number to a number established in a policy. Alarm messagesthat arrive at a frequency lower than that specified in the policy canbe ignored. Alternatively, such alarms can be aggregated into a singlerepresentation. When the frequency of an alarm exceeds the establishedthreshold, an additional alarm can be generated and used as anadditional (potentially higher priority) alarm representation. In oneembodiment, different policies and thresholds can be applied to alarmsfrom different sources or of different types.

De-duplication and frequency-based filtering are similar in that theyboth deal with representing multiple alarms of the same or similar typeby a single alarm. The difference between the two types of filtering isthat frequency-based filtering is concerned with the temporal aspect ofthe alarms. In de-duplication, repetitive alarms of a particular typeare masked regardless of when other alarms of that type occurred. Infrequency-based filtering, it is the number of alarms of a particulartype or from a particular source that occur over a particular timeperiod that determines whether or not an alarm representation isgenerated.

Elements can send “clear” messages to indicate that a previous alarmcondition no longer exists. In a non-temporal filtering system that canbe referred to as clear message mapping, mapping tables can bemaintained that relate clear messages to the types of alarms to whichthey apply. Software-based logic can be used to search the mappingtables and automatically flag previously received alarms as cleared,indicating that they have become inactive. This can eliminate the needfor manual intervention. Clear messages typically originate from thesame element as the original alarm and thus contain identifiers of theirsource, eliminating the need for matching alarms with element topologydata from an external source. Based on this, the cleared alarm or alarmrepresentation may be removed from the alarm status report.

Under certain circumstances, an element can enter a cyclic pattern ofalarm activation and clearing. That is, an alarm can be followed closelyby a clear message and this pattern can continuously repeat. Such ascenario can indicate a problem requiring direct intervention. In atemporal filtering system that can be referred to as cycling-basedfiltering, policies on cycling frequency are created. A countingmechanism determines the number of alarm/clear cycles that occur in aperiod of time and compares that number to a number established in apolicy. When the number of alarm/clear cycles exceeds the establishedlevel, an additional alarm can be generated as the alarm representation.A severity escalation mechanism can also be included so that when thenumber of alarm/clear cycles exceeds the established level, the severity(also referred to as the priority) of the additional alarmrepresentation is increased beyond the level of the original alarms.

As is the case with de-duplication and frequency-based filtering, clearmessage mapping and cycling-based filtering are similar except for thetemporal aspect of how they deal with alarms. In clear message mapping,clear messages are mapped to the alarms to which they correspondregardless of how often the clear messages, or their base alarms, occur.In cycling-based filtering, it is the frequency at which alarms areactivated and then cleared that determines whether or not an alarmrepresentation is generated.

An additional type of non-temporal filtering which may be employed isClassification filtering. Classification filtering may be appliedagainst the source (for example element type or geographic region) ofthe message or may also be applied against the type of message beingsent regardless of source. Classification filtering may be used by anoperations group to mask alarms that are not meaningful to particularstaff roles. For example, although the entire staff may use a commontool for monitoring, particular sub-teams may be assigned to monitoronly specific types of network elements. For these individuals,classification filters can be used to remove all alarms and alarmrepresentations from display that do not result directly from theelements types within their domain of interest. Alternatively, groupsmight be assigned to support elements within a specific geographicregion, so all alarms from elements outside that region would not bedisplayed to them.

Classification by message type is a more fined-grained version of thesame principle. Some elements may produce informational messages of nointerest in a particular operations context. For example, a switch mightsend a message each time its cabinet door is opened or closed. When nopolicy or business rule has been developed that would make an alarmmeaningful, many groups prefer to remove that alarm type from display.For one organization the opening or closing of a cabinet door can beused as evidence of human presence which could then be checked againstsecurity policies, especially for unmanned sites, where a violation ofpolicy might trigger intervention, like a call to the police or to asecurity firm for investigation. Yet others might have no suchrequirements and simply want the door-related messages removed from thedisplay. In almost every case, a scenario can be imagined where amessage type provides useful information, yet in practical settings,certain types of alarms are of no value. Environmental alarms might behandled by one organization while service-related alarms are handled byanother; each would use an appropriate message type based filter.

Internal linkage-based filtering deals with messages that come fromdifferent components within the same element. It requires a model of theelement, including internal components, to determine alarmrelationships. When a component fails, some elements will send an alarmfor that failed component and a separate alarm for each of the otherlocally impacted components or services. While these additional messagescan be helpful for impact analysis, they can often distract and confuseoperators searching for root causes. Systematically hiding theseadditional messages from surveillance displays and downstream processesallows for faster problem correction. The original alarm from theoriginal failed component can then act as the alarm representation.Internal linkage-based filtering requires the existence of a topologythat describes the interconnections among all components within anelement. Information regarding which alarms are generated by whichcomponents is also needed, as well as a model of which alarm typesrelate to each other. An additional alarm can be generated to notifyoperators that other alarms have been suppressed.

As an example of internal linkage-based filtering, within a networkelement, such as an ATM switch or a frame relay switch, several circuitcards might be present on a single backplane. Within each ATM card, forexample, multiple ports might be present. The failure of an ATM cardwould result in each of the ports on the card becoming inoperable. Thenetwork element might have been designed to generate separate alarms forthe failure of the card and for the failure of each of its ports. Fromthe perspective of a network technician responsible for diagnosing andrepairing equipment problems, the additional port alarms distract fromthe root problem. With internal linkage-based filtering, the alarms fromthe ports can be masked and/or subordinated to the card alarm. Softwarecan be present that examines the topology of the ATM card and itscomponent parts and recognizes that the alarms coming from the ports arelikely to have been caused by the failure of the ATM card. The softwarecan then ignore or remove from the display the alarms for the ports anduse the alarm from the ATM card itself as an alarm representation.Alternatively, the alarms can be sent to a display where they can beexamined by a technician who can decide whether the alarms from theports can be safely removed from display.

External linkage-based filtering relates messages from multipleelements. Many protocols require synchronization signals or periodicstatus exchanges among elements in a network. These often specify thatalarms be generated when signals are not properly received. Someprotocols require the forwarding of special signals along the entirecommunications path of a service when a failure occurs at any point inthe path. This signal forwarding alerts all elements along the path thata problem has occurred. Thus, a failure at one point in a network cancause alarms to propagate and cause sympathetic alarms to be generatedby elements not actually responsible for the failure. Externallinkage-based filtering is intended to systematically hide sympatheticalarms from alarm monitoring mechanisms and downstream processes, whilefocusing operator attention on the most likely causes of the originalalarm. In many cases, this may require the creation of a new alarmrepresentation documenting the reason for the grouping of the otheralarms. Knowledge of network element topology is needed to determinealarm relationships. Generally, this interconnected view of topologymust be provided from an external source, such as a network modelmaintained within one or more network provisioning systems.

As an example of external linkage-based filtering, a communicationschain between two points can comprise multiple elements connected in aserial fashion. Data can flow from one end point to the other througheach of the elements in turn. Each element can have the capability togenerate an alarm if it does not receive data when it expects to or ifthe data it receives appears to be invalid. Thus, if one element in achain ceases to transmit data it can generate an alarm and can causesubsequent elements in the chain to also generate alarms when they failto receive data from the previous element in the chain. The alarms fromthe subsequent elements can be considered superfluous since they wouldbe generated by the fact that the original element ceased to transmitdata and that element would have already generated its own alarm. Withexternal linkage-based filtering, the alarms from the subsequentelements can be identified as related to one another and masked and/orsubordinated under a single alarm representation. Software can bepresent that examines the topology of the elements in the chain andrecognizes that the alarms coming from subsequent elements of the chainare likely to have been caused by the failure of the original element totransmit data. The software can then suppress the subsequent alarms anduse the original alarm as an alarm representation.

While the preceding example used a simple serial chain of elements forillustrative purposes, in actual practice the topology of the elementsis likely to be more complicated. Each element might be connected tonumerous other elements in a highly complex configuration. In addition,numerous different types of alarms might occur. This means that anaccurate topological map and a thorough understanding of all alarms thatmight occur are preferable in order for external linkage-based filteringto be fully implemented.

Internal linkage-based filtering and external linkage-based filteringcan be referred to collectively as linkage filtering. The two types oflinkage filtering are similar in that both involve the display maskingand/or subordination of an alarm in an element or component that resultsfrom conditions in another element or component. The difference betweenthe two types of linkage filtering is that internal linkage-basedfiltering deals with components within a single element. Alarms fromdependent components within the element are consolidated into a singlealarm representation. External linkage-based filtering deals withmultiple elements. Alarms from dependent components across multipleelements are consolidated into a single alarm representation.

For either or both of the linkage-based filtering approaches, partialimplementations may provide advantages even in the absence of fullimplementation. Since each typically involves detailed or complex rulemaking and/or mapping, rules or maps may be constructed for alarms ornetworks or components which are causing particular issues to assist inreducing noise from those places. As more time and resources areavailable and as different or new issues come to the fore as ripe forfiltering, additional linkages for filtering may be added. This kind ofincremental implementation for linkage based filtering may provide thesame advantages with a more practical budget and flexible approach inmoving towards incrementally improving the alarm status report and theenvironment for the technicians using the alarm status report.

The seven types of filtering can be implemented individually or in anycombination. In one embodiment, non-temporal filtering (such asde-duplication, clear-message mapping, and/or classification filtering)and temporal filtering (such as frequency-based filtering and/orcycling-based filtering) are used in combination with linkage filtering(such as external-linkage filtering and/or internal linkage filtering).In a preferred embodiment, de-duplication, frequency-based filtering,clear message mapping, and cycling-based filtering are used incombination with linkage filtering. In this embodiment, when an alarm isgenerated it is captured and categorized according to the type offiltering that can be performed on it. The appropriate type or types offiltering are then performed on the alarm. Filters can be applied in anyorder and in either a serial or a parallel manner. After the filtershave been applied, a report can be created that displays the alarmrepresentations that represent the underlying alarms. This process cancontinue in an iterative manner in which the report is continuouslyupdated as alarms are generated, captured, categorized, and filtered.

In an embodiment, the underlying alarms can be included in a report inaddition to the alarm representations. This gives an alarm-monitoringtechnician the ability to view the underlying alarms if desired. If thereport is displayed on a computer screen or other visual medium, anoption can be provided that allows the viewing of the underlying alarms,the alarm representations, or both. In a preferred embodiment, bothalarm representations and underlying alarms that have not beensubordinately linked to an alarm representation are displayed. In thisembodiment, if the proper criteria for subsequent filter rules are met,alarm representations may be aggregated under other alarmrepresentations in a manner similar to the way underlying alarms can beaggregated under an alarm representation.

An embodiment of the invention is illustrated in FIG. 1. In box 12, analarm is generated by an element or a component of an element in anetwork. The alarm is captured in box 14. In box 16, the alarm iscategorized according to which type or types of filtering can beperformed on it. If de-duplication can be done on the alarm,de-duplication is performed in box 18. If frequency-based filtering canbe done on the alarm, frequency-based filtering is performed in box 20.If clear message mapping can be done on the alarm, clear message mappingis performed in box 22. If cycling-based filtering can be done on thealarm, cycling-based filtering is performed in box 24. If classificationfiltering can be done on the alarm, classification filtering isperformed in box 26. If internal linkage-based filtering can be done onthe alarm, internal linkage-based filtering is performed in box 28. Ifexternal linkage-based filtering can be done on the alarm, externallinkage-based filtering is performed in box 30. Any one type or anycombination of types of filtering shown in boxes 18, 20, 22, 24, 26, 28,or 30 can be performed. After any type of filtering or any combinationof filtering types is performed, a report can be updated as shown in box32. This process of alarm generation, alarm capture, alarmcategorization, alarm filtering, and report updating can occur in a loopthat repeats to handle all new and existing alarms.

In addition to the seven types of alarm filtering described above,alarms can be filtered based on the operational or lifecycle state ofthe elements in a network. State-based filters can block from thedisplay (or can specifically filter for depending on the needs of theparticular user) elements not yet fully deployed or in a maintenancestate. At the highest level the general categories of lifecycle statecan be defined as: operational and non-operational. Non-operationalstates may be generally divided into pre-acceptance and post-acceptance.Pre-acceptance non-operational states may include one of the following:planned (not yet deployed), deployed (physically fielded, but not yetverified), or tested (verified, but not yet operationally accepted).Post-acceptance states may include one of the following: blocked(physically present but inhibited from use) and defective (physicallypresent, but unusable). Operational states may be generally divided intonormal (operating as intended) or maintenance. Maintenance states mayinclude testing (currently being tested), scheduled maintenance(currently being maintained), emergency recovery (unscheduledmaintenance), or reallocated (temporarily reconfigured differently thanrecorded by provisioning records, for example to act as a work-around tosolve a problem with another portion of the network). These states maybe recorded and updated (or tracked) independently for all or selectedresources. They may be recorded and updated as an element of a networkmodel (topology, inventory, or combination of both) modeling the networkwhich includes the subject resources. They may be recorded and updatedas an element of a provisioning or configuration record which includesthe subject resources. The filtering system can then refer to the model,records, or independently stored state information to assist inevaluating various alarms and/or alarm representations. Any of a numberof possible approaches to this storage and access would be understood tothose of skill in the art, and Would provide many or all of theadvantages sought from incorporating state-based filtering. States couldbe tracked for at least a portion of the elements in a network or forall of the elements in a network. At least a portion of the alarmsgenerated by elements for which the lifecycle state is tracked may befiltered for state or all of the alarms generated by tracked elementsmay be filtered for state.

States can be used to provide different alarm filtering views, useful inaddressing different operational tasks. Many alarms can occur during thepre-acceptance processes of installing and deploying new elements. Theseare typically of interest only to operational personnel validating andaccepting new elements and can be filtered out of the standard alarmmonitoring process or actively selected for more specialized tasks. Forexample, a remote operator working with field technicians to verify thecorrect configuration of newly configured elements can use a filteredview focusing on elements in the pre-acceptance state of deployed.However, for monitoring of normal operations, alarms from all resourcesthat are not in an operational state are typically filtered as noise.

Even within the operational state, there may be transient changes toresources which may be helpful to distinguish and filter for. Thesetemporary state changes relate to what may be referred to herecollectively as maintenance activities, by which is meant activitiesrequired to effectively operate, maintain, and repair a networkincluding testing, maintenance, emergency recovery, and reallocation.Generally these activities temporarily disrupt normal networkoperations, and often cause conditions that trigger the generation ofadditional network alarms. Because of the special nature of theseactivities and the predictable alarm responses, it may be desirable toseparate these alarms from normal monitoring to prevent confusion. Thesealarms might otherwise cause an operator to attempt unnecessary repairsthat might compromise the other special-purpose activities thatindirectly caused the alarms. Network maintenance is an example of anactivity that can also trigger additional alarms. During network changeactivity, selected resources may be disconnected or changed as part of alarger reconfiguration activity. These intermediate changes often leaveservices or resources in abnormal states until other configurationactivities are completed. In some embodiments, alarms from theseresources can be treated as the expected side effects of the maintenanceactivities and can also be filtered from standard alarm monitoring.However, special maintenance views can also be helpful in answeringquestions about whether particular resources should be a concern or notduring a maintenance period, say in response to an unexpected customercomplaint that arrives during a maintenance period. In one embodiment ofoperations, some combination of state-based filtering may be usedindependently from the seven filters previously discussed. In otherembodiments of operation, a combination of state-based filtering and anyor all of the components or sub-components of non-temporal, temporal,and linkage-based filtering as described above may be used.

In an alternative improvement to the alarm status report and alarmstatus filtering and reporting system, technicians may be provided theability to manually group related alarms under a single alarmrepresentation for reporting purposes. In this manner, a technician mayreduce the number of reported alarms based on his own evaluation ofrelated alarms. This could simplify the display for other techniciansand also reduce the chance that multiple technicians will end up workingon the same problem by starting from different, but related, alarms. Inyet an additional embodiment, records could be kept of the alarmsmanually combined and where consistent or repeating patterns areobserved, plans could be made to implement new filters where practical,particularly linkage-based filters, to group these alarms automaticallyin the future.

Although only a few embodiments of the present invention have beendescribed, it should be understood that the present invention may beembodied in many other specific forms without departing from the spiritor the scope of the present invention. The present examples are to beconsidered as illustrative and not restrictive, and the invention is notto be limited to the details given herein, but may be modified withinthe scope of the appended claims along with their full scope ofequivalents.

1. A method for creating an updateable report representing the alarmstatus of a network comprising: categorizing all alarms generated in thenetwork based on the source and type of alarm; placing the alarms in atleast one filtering system based on source and type, wherein thefiltering system replaces selected alarms with alarm representations,and wherein the filtering system includes each of a group of filteringsystems comprising: a temporal filtering system, wherein the temporalfiltering system includes at least one temporal filter that is selectedfrom a group of temporal filters comprising: a frequency-based filterthat generates a temporal alarm representation that replaces multiplealarms in response to a quantity of the multiple alarms exceeding athreshold within a period of time; and a cycling-based filter thatgenerates a second temporal alarm representation that replaces multiplealarms in response to a quantity of cycles of the multiple alarmsexceeding a threshold within a period of time, wherein each cycle of themultiple alarms includes generating an alarm followed by clearing thealarm; and a linkage-based filtering system, wherein the linkage-basedfiltering system generates a linkage-based alarm representation thatreplaces sympathetic alarms generated by portions of the networkimpacted by a failure of a first portion of the network; and updating areport with the alarm representations.
 2. The method of claim 1, whereinthe linkage-based filtering system is an external linkage-basedfiltering system such that the portions of the network include elementswithin the network and the first portion of the network includes a firstelement in the network.
 3. The method of claim 1, wherein the group offiltering systems further comprises: a non-temporal filtering system. 4.The method of claim 3, wherein the group of filtering systems furthercomprises: a classification filtering system.
 5. The method of claim 3,wherein the non-temporal filtering system includes at least onenon-temporal filter that is selected from a group of non-temporalfilters comprising a de-duplication filter and a clear message mappingfilter.
 6. The method of claim 5, wherein the non-temporal filteringsystem includes each of the de-duplication filter and the clear messagemapping filter.
 7. The method of claim 5, wherein the de-duplicationfiltering system generates a de-duplication alarm representation thatmasks alarms that are repeated while an alarm condition is maintained,and wherein the clear message mapping filtering system that removesalarms or alarm representations in response to receiving a clear messagefrom an originator of the alarms or alarms replaced by the alarmrepresentations.
 8. The method of claim 3, wherein the non-temporalfiltering system includes at least one non-temporal filter that isselected from a group of non-temporal filters comprising ade-duplication filter, a clear message mapping filter, and aclassification filter.
 9. The method of claim 8, wherein thenon-temporal filtering system includes each of the de-duplicationfilter, the clear message mapping filter, and the classification filter.10. The method of claim 3, wherein the non-temporal filtering systemincludes each of a group of non-temporal filters comprising ade-duplication filter and a clear message mapping filter and wherein thetemporal filtering system includes each of the frequency-based filterand a cycling-based filter.
 11. The method of claim 1, wherein thelinkage-based filtering system includes at least one linkage-basedfilter that is selected from a second group of linkage-based filterscomprising an internal linkage-based filter, wherein the portions of thenetwork include components within an element and the first portion ofthe network includes a first component in the element, and an externallinkage-based filter, wherein the portions of the network includeelements within the network and the first portion of the networkincludes a first element in the network.
 12. The method of claim 11,wherein the linkage-based filtering system includes each of the internallinkage-based filter and the external linkage-based filter.
 13. Themethod of claim 1, wherein the temporal filtering system includes eachof the frequency-based filter and the cycling-based filter.
 14. Themethod of claim 1, wherein the network comprises the interconnectednetworks of an enterprise.
 15. The method of claim 1, wherein thenetwork comprises the interconnected networks of a single domain of anenterprise.
 16. The method of claim 15, wherein the domain comprises abusiness domain of the enterprise.
 17. The method of claim 15, whereinthe domain comprises an operating system domain of the enterprise. 18.The method of claim 1, wherein the network comprises a group of clientcomputers connected to a server computer.
 19. The method of claim 1,wherein the report is displayed on a computer screen.
 20. The method ofclaim 1, wherein the report is sent to another location for furtherprocessing.
 21. A method for creating an updateable report representingthe alarm status of a network comprising: categorizing all alarmsgenerated by one or more elements in a network based on the source andtype of alarm; placing the alarms in at least one filtering system basedon source and type, wherein the filtering system replaces selectedalarms with alarm representations, and wherein the filtering systemincludes each of a group of filtering systems comprising: a non-temporalfiltering system wherein the non-temporal filtering system includes atleast one non-temporal filter that is selected from a group ofnon-temporal filters comprising: a de-duplication filter that generatesa de-duplication alarm representation that masks alarms that arerepeated while an alarm condition is maintained; and a clear messagemapping filter that removes alarms or alarm representations in responseto receiving a clear message from the one or more elements thatoriginally generated the alarms or alarms replaced by the alarmrepresentations; and an external linkage-based filtering system thatgenerates a linkage-based alarm representation that replaces sympatheticalarms generated by elements of the network impacted by a failure of afirst element of the network; and updating a report with the alarmrepresentations.
 22. The method of claim 21, wherein the non-temporalfiltering system includes at least one non-temporal filter that isselected from a group of non-temporal filters comprising thede-duplication filter, the clear message mapping filter, and aclassification filter.
 23. The method of claim 22, wherein thenon-temporal filtering system includes each of the de-duplicationfilter, the clear message mapping filter, and the classification filter.24. The method of claim 23, wherein the classification filter masksalarms based on a source of the alarms, types of elements generating thealarms, a location of elements generating the alarms, or a type of thealarms.
 25. The method of claim 21, wherein the non-temporal filteringsystem includes each of the de-duplication filter and the clear messagemapping filter.
 26. A method for creating an updateable reportrepresenting the alarm status of a network comprising: categorizing allalarms generated in a network based on the source and type of alarm;placing the alarms in at least one filtering system based on source andtype, wherein the filtering system replaces selected alarms with alarmrepresentations, and wherein the filtering system includes each of agroup of filtering systems comprising: a de-duplication filtering systemthat generates a de-duplication alarm representation that masks alarmsthat are repeated while an alarm condition is maintained; a clearmessage mapping filtering system that removes alarms or alarmrepresentations in response to receiving a clear message from anoriginator of the alarms or alarms replaced by the alarmrepresentations; a frequency-based filtering system that generates atemporal alarm representation that replaces multiple alarms in responseto a quantity of the multiple alarms exceeding a threshold within aperiod of time; and a cycling-based filtering system that generates asecond temporal alarm representation that replaces multiple alarms inresponse to a quantity of cycles of the multiple alarms exceeding athreshold within a period of time, wherein each cycle of the multiplealarms includes generating an alarm followed by generating a clearmessage; and updating a report with the alarm representations.
 27. Themethod of claim 26, wherein the group of filtering systems furthercomprises: a classification filtering system that masks alarms based ona source of the alarms, types of elements generating the alarms, alocation of elements generating the alarms, or a type of the alarms. 28.A method for monitoring the alarm status of a network comprising:capturing alarms generated by elements of the network; applying at leastone filter to the alarms wherein the filter generates alarmrepresentations for selected alarms and wherein the filters include eachof a group of filters comprising: non-temporal filters, wherein thenon-temporal filters include at least one non-temporal filter that isselected from a group of non-temporal filters comprising: ade-duplication filter that generates a de-duplication alarmrepresentation that masks alarms that are repeated while an alarmcondition is maintained; and a clear message mapping filter that removesalarms or alarm representations in response to receiving a clear messagefrom corresponding ones of the elements that originally generated thealarms or alarms replaced by the alarm representations; temporalfilters, wherein the temporal filters include at least one temporalfilter selected from a group of temporal filters comprising: afrequency-based filter that generates a temporal alarm representationthat replaces multiple alarms in response to a quantity of the multiplealarms exceeding a threshold within a period of time; and acycling-based filter that generates a second temporal alarmrepresentation that replaces multiple alarms in response to a quantityof cycles of the multiple alarms exceeding a threshold within a periodof time, wherein each cycle of the multiple alarms includes generatingan alarm followed by clearing the alarm; and linkage-based filters,wherein the linkage-based filters generate a linkage-based alarmrepresentation that replaces sympathetic alarms generated by portions ofthe network impacted by a failure of a first portion of the network;displaying the generated alarm representations and a selection of thealarms which have passed through the filters; monitoring the display;and taking action in response to the displayed alarm representations andalarms.
 29. The method of claim 28, wherein the non-temporal filtersinclude at least one non-temporal filter selected from a group ofnon-temporal filters comprising the de-duplication filter, the clearmessage mapping filter, and a classification filter.
 30. The method ofclaim 29, wherein the non-temporal filters include each of thede-duplication filter, the clear message mapping filter, and theclassification filter.
 31. The method of claim 29, wherein theclassification filter masks alarms based on a source of the alarms,types of elements generating the alarms, a location of elementsgenerating the alarms, or a type of the alarms.
 32. The method of claim28, wherein the linkage-based filters include at least one linkage-basedfilter selected from a group of linkage-based filters comprising aninternal linkage-based filter and an external linkage-based filter. 33.The method of claim 32, wherein linkage-based filters includes each ofthe internal linkage-based filter and the external linkage-based filter.34. The method of claim 28, wherein the non-temporal filters includeeach of the de-duplication and the clear message mapping filter.
 35. Themethod of claim 28, wherein the temporal filters include each of thefrequency-based filter and the cycling-based filter.
 36. The method ofclaim 28, wherein the non-temporal filters include each of thede-duplication filter and the clear message mapping filter and whereinthe temporal filters include each of the frequency-based filter and thecycling-based filter.
 37. The method of claim 28, further comprisinghuman monitors generating alarm representations and grouping selectedalarms subordinate to the alarm representations.